Proxy also lets you bootstrap auth tokens at proxy layer without giving clause access to the auth identity. Greatly limiting the exfil risk.